Security Advisory

CVE-2026-66373

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-25 00:08:35

Last updated 2026-07-25 00:08:35

Assigner mitre

CVSS score 7.5

State PUBLISHED

Description

Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.

← Browse all CVEs View on cve.org ↗